Why the security that protects your accounts is the same thing that locks out your heirs

Ask a locksmith to let you into your own house and the first thing they'll want is proof it's your house. Security recovery works the same way. Lose your phone, forget a password, wipe the device your authenticator lived on, and the system has to let you back in without letting a stranger in behind you. Strip away the jargon and every recovery standard comes down to one question: can we be sure you're the person who set this up?

NIST, whose Digital Identity Guidelines much of the industry follows, is blunt about the bargain. The way back in must never be easier than the front door. If a thief can reset your access more cheaply than they can crack your password, the reset is now the weakest point, and that's where they'll come. So the guidance pushes the other way. Fall back to another strong method you already registered, and where there isn't one, prove your identity again from scratch. Its FAQ is just as flat about the old habit of security questions: treat them as an authenticator and you've more or less handed an attacker the account.

Look at what those routes have in common. Every one needs you. A second device in your hand. A code sent to your number. A document that says you're you. A face at a counter. Recovery isn't a magic reset button. It's a smaller, stricter rerun of the day you first proved who you were. For a living person locked out, that is exactly right. It is also why the whole thing collapses the moment that person is gone.

There's a second kind of recovery that matters even more here, and it's worth prising apart from the first. Account recovery gets a person back through a provider's door. Key recovery is about the cryptographic key itself. NIST defines it as the mechanisms that let authorised people rebuild a key from a backup or an archive, rather than from the single working copy. It sounds like a distinction for specialists, right up until you notice which kind a modern vault, a self-custody wallet or an end-to-end encrypted service actually leans on.

In a custodial system the company holds the keys. It can re-check a grieving family, run a bereavement process, and hand things across slowly and with paperwork. Crucially, there's a human on the other end. A key-based system has no such human. The entire point of end-to-end encryption and zero-knowledge design is that the provider never holds a key that could open your data. NIST's key-management guidance spends real effort on how keys get backed up and archived for exactly this reason: without a deliberate recovery mechanism, a lost key means the data is gone, and nobody can un-lose it.

So the two recoveries pull opposite ways. The service best placed to help your family is the one that kept a copy of the key it could hand over, which is the very copy a thief would most like to find. The service that best protects you while you're alive kept no such copy, and so has nothing to give anyone once you're gone. At this layer, strength and inheritability are one dial, turned in opposite directions.

Set those two ideas side by side and the inheritance problem stops being a mystery. Every recovery route in the standards exists to answer one question: are you really you? A living person can answer it. They still hold the second key, can take the code, can produce the document, can walk into an office. Recovery is patient and strict on purpose, and the person it's being strict about is around to satisfy it.

Death takes away the answer, not the question. The system still demands proof that the account holder is here and consenting, and the account holder is the one thing missing. No second device to tap. No code to read out. No face to match. The safeguard that keeps a stranger out keeps your daughter out too, because the machine can't tell an heir from an impostor. To it, both are simply not-you.

This is why handing over a password in advance tends to backfire rather than help. It doesn't answer the identity question, it sneaks past it, and modern systems are built to notice. A login from a new device, a new place, a new rhythm of behaviour trips the fraud checks and freezes the account instead of opening it. The protection is doing its job. It just can't know that this particular intruder is the one you wanted in. A real inheritance plan has to supply the missing proof through a channel the system will accept, not pick the lock and hope.

The way out was worked out in cryptography long before anyone framed it as an inheritance problem. In 1979 Adi Shamir described a scheme for cutting a secret into pieces, called shares, so that a chosen number of them brought back together rebuild the secret, while any smaller number reveal nothing at all. Not a little. Nothing. On its own, a share is just noise. That reconstruction idea is what sits underneath what NIST calls key recovery: rebuild the key from separate custodians instead of from one exposed copy.

The word doing the work is threshold. You pick the shape. Cut five shares, set the threshold at three, and any three of the five rebuild the secret while two never can. That one choice defends against both failures at once. No lone share-holder can act, so nobody can betray you or be leaned on to open the vault early. And no single loss is fatal. A share can be burned, mislaid, or held by someone who drifts out of your life, and the rest still reach the threshold. You've taken out the single point of failure without creating a single point of trust.

Don't confuse this with the kitchen-table version, half a password in one drawer and half in another. A half-secret isn't noise. It leaks which characters exist and shrinks what an attacker has to guess, so two careless halves can be weaker than the whole ever was. A real threshold scheme is different in kind, not degree: below the threshold, a share tells an adversary precisely nothing. That guarantee is what lets you scatter the pieces widely without scattering the risk.

A threshold scheme is a tool, not a plan, and its two failure modes map neatly onto the two things an inheritance plan has to get right. Stay shut while you're alive and well. Open for the right people once you're not, without ever needing you there to prove it. Splitting the secret handles the first half. The second half needs a way to reassemble the pieces, plus a check that the moment is genuine: the identity work death made impossible for the account holder to do.

In practice that means the shares need homes, and the reassembly needs a trigger you'd trust. One person holding everything is the single point of failure all over again. A heap of shares nobody knows how to combine is a locked box with the key thrown away. The engineering that helps holds the pieces apart, keeps them sealed while you're around to object, and brings them together only after a proper, evidence-based check that access is warranted. That's the gap a zero-knowledge vault like LifeWyn is built to fill. It can split and reunite the secret without ever keeping a master copy that would undo the security in the first place.

None of this touches the legal side, and it isn't meant to. Who's entitled to what, and how an estate is wound up, varies enormously from one country to the next, so check what applies where you live. The point here is narrower, and for once it's cheering. The apparent contradiction, that security and inheritability are at war, only holds if you insist on keeping the secret in one piece. Split it properly and you get both: nothing worth stealing while you're alive, and everything your family needs the day they need it.